System and method for circuit and path based event correlation

ABSTRACT

A method, system and computer-usable medium are disclosed for the correlation of network events. A port of a network device is monitored at the physical layer interface for the occurrence of a network event. If detected, a repository of circuit path, network device, and device interface data is queried for information related to the network event and each network device at each hop of the circuit path associated with the event. A user selects time intervals for other network events or alarms occurring before or after the target event. A repository of network event and alarm data is then queried to retrieve all network events or alarms occurring during the selected time interval. Information related to the network events or alarms are then compared to interfaces related to devices that are likewise associated with the circuit path associated with the event.

BACKGROUND OF THE INVENTION

1. Field of the Invention

Embodiments of the disclosure relate in general to the field ofcomputers and similar technologies, and in particular to softwareutilized in this field. Still more particularly, it relates to method,system and computer-usable medium for the correlation of network events.

2. Description of the Related Art

The demand for increased network speeds and bandwidth by consumers,businesses, and government continues to increase. As a result, the useof. Synchronous Optical Networking (SONET) and Synchronous DigitalHierarchy (SDH) technologies in today's networks is becomingcommonplace. These networks, based on optical technologies, are capableof delivering large amounts of bandwidth. As an example, an OpticalCarrier 3 (OC3) circuit can deliver data transmission speeds of 155Megabits/second, while an OC192 circuit can deliver 10 Gigabits/second.

However, the size, speed, diversity, and complexity of these networkscreate corresponding challenges in their effective management.Furthermore, these networks are becoming increasingly interconnected,which creates additional challenges. As an example, a link failure in aSONET/SDH network may cause multiple sympathetic network events oralarms to emanate from circuits that have upper layer time slots. Thesenetwork events or alarms can likewise result from the ingress and egressof each time slot of each circuit. As an example, an Optical Carrier 3(OC3) failure occurring in a circuit can cause network management alarmsto emanate from each of the three Digital Signal 3 (DS3) time slots oneach side of the circuit. As a result, sympathetic network events andalarms emanate from affected devices and circuits along the path.

Determining which of these network events and alarms is associated witha root cause of a network issue can prove problematic. Currentapproaches to managing lower layer events include suppressing thesympathetic events that occur for time slots and terminations affectedby the event. In other approaches for the management of router andswitch-based networks, there are times when the path between two pointscan be known with certainty. The challenge is to then connect the eventsalong a path to any lower lying event that might have caused theproblem. However, there is no current solution for correlating theseevents.

BRIEF SUMMARY OF THE INVENTION

The present invention includes, but is not limited to, a method, systemand computer-usable medium for the correlation of network events. Invarious embodiments, an event correlation module is implemented with anetwork management system to perform event correlations of networkevents or alarms. In these and other embodiments, a Synchronous OpticalNetworking (SONET) or Synchronous Digital Hierarchy (SDH) port of anetwork device is monitored for the occurrence of a loss of signal (LOS)or a loss of frame (LOF) event. Likewise in these embodiments, themonitoring of the SONET/SDH port is at the physical layer interface, nota time slot.

If a LOS/LOF network event is detected, then a repository of circuitpath, network device, and device interface data is queried forinformation related to the LOS/LOF network event. The repository islikewise queried for information related to each network device at eachhop of the circuit path associated with the LOS/LOF network event. Invarious embodiments, a user of the event correlation module selects timeintervals for other network events or alarms occurring before or afterthe target LOS/LOF network event. A repository of network event andalarm data is then queried to retrieve all network events or alarmsoccurring during the selected time interval. In various embodiments, thequeries are performed by the event correlation module.

Information related to the network events or alarms occurring during theselected time interval are then compared to interfaces related todevices that are likewise associated with the circuit path associatedwith the LOS/LOF network event. In one embodiment, if the network eventor alarm occurring within the selected time interval does not match theinterface, then it is associated as a child network event of the LOS/LOFnetwork event. In another embodiment, the foregoing process is likewisefollowed for network path query events. However, if the network event oralarm occurring within the selected time interval matches the interface,then it is associated as a parent network event of a network path queryevent. The above, as well as additional purposes, features, andadvantages of the present invention will become apparent in thefollowing detailed written description.

BRIEF DESCRIPTION OF THE DRAWINGS

Selected embodiments of the present invention may be understood, and itsnumerous objects, features and advantages obtained, when the followingdetailed description is considered in conjunction with the followingdrawings, in which:

FIG. 1 depicts an exemplary client computer in which the presentinvention may be implemented;

FIG. 2 is a simplified block diagram of an event correlation module asimplemented in an embodiment of the invention;

FIG. 3 is a flow chart of the operation of an event correlation moduleas implemented for the correlation of child events in a network; and

FIG. 4 is a flow chart of the operation of an event correlation moduleas implemented for the correlation of parent events in a network.

DETAILED DESCRIPTION

A method, system and computer-usable medium are disclosed for thecorrelation of network events. As will be appreciated by one skilled inthe art, the present invention may be embodied as a method, system, orcomputer program product. Accordingly, embodiments of the invention maybe implemented entirely in hardware, entirely in software (includingfirmware, resident software, micro-code, etc.) or in an embodimentcombining software and hardware. These various embodiments may allgenerally be referred to herein as a “circuit,” “module,” or “system.”Furthermore, the present invention may take the form of a computerprogram product on a computer-usable storage medium havingcomputer-usable program code embodied in the medium.

Any suitable computer usable or computer readable medium may beutilized. The computer-usable or computer-readable medium may be, forexample, but not limited to, an electronic, magnetic, optical,electromagnetic, infrared, or semiconductor system, apparatus, device,or propagation medium. More specific examples (a non-exhaustive list) ofthe computer-readable medium would include the following: an electricalconnection having one or more wires, a portable computer diskette, ahard disk, a random access memory (RAM), a read-only memory (ROM), anerasable programmable read-only memory (EPROM or Flash memory), anoptical fiber, a portable compact disc read-only memory (CD-ROM), anoptical storage device, a transmission media such as those supportingthe Internet or an intranet, or a magnetic storage device. Note that thecomputer-usable or computer-readable medium could even be paper oranother suitable medium upon which the program is printed, as theprogram can be electronically captured, via, for instance, opticalscanning of the paper or other medium, then compiled, interpreted, orotherwise processed in a suitable manner, if necessary, and then storedin a computer memory. In the context of this document, a computer-usableor computer-readable medium may be any medium that can contain, store,communicate, propagate, or transport the program for use by or inconnection with the instruction execution system, apparatus, or device.The computer-usable medium may include a propagated data signal with thecomputer-usable program code embodied therein, either in baseband or aspart of a carrier wave. The computer usable program code may betransmitted using any appropriate medium, including but not limited tothe Internet, wireline, optical fiber cable, radio frequency (RF), etc.

Computer program code for carrying out operations of the presentinvention may be written in an object oriented programming language suchas Java, Smalltalk, C++ or the like. However, the computer program codefor carrying out operations of the present invention may also be writtenin conventional procedural programming languages, such as the “C”programming language or similar programming languages. The program codemay execute entirely on the user's computer, partly on the user'scomputer, as a stand-alone software package, partly on the user'scomputer and partly on a remote computer or entirely on the remotecomputer or server. In the latter scenario, the remote computer may beconnected to the user's computer through a local area network (LAN) or awide area network (WAN), or the connection may be made to an externalcomputer (for example, through the Internet using an Internet ServiceProvider).

Embodiments of the invention are described below with reference toflowchart illustrations and/or block diagrams of methods, apparatus(systems) and computer program products according to embodiments of theinvention. It will be understood that each block of the flowchartillustrations and/or block diagrams, and combinations of blocks in theflowchart illustrations and/or block diagrams, can be implemented bycomputer program instructions. These computer program instructions maybe provided to a processor of a general purpose computer, specialpurpose computer, or other programmable data processing apparatus toproduce a machine, such that the instructions, which execute via theprocessor of the computer or other programmable data processingapparatus, create means for implementing the functions/acts specified inthe flowchart and/or block diagram block or blocks.

These computer program instructions may also be stored in acomputer-readable memory that can direct a computer or otherprogrammable data processing apparatus to function in a particularmanner, such that the instructions stored in the computer-readablememory produce an article of manufacture including instruction meanswhich implement the function/act specified in the flowchart and/or blockdiagram block or blocks.

The computer program instructions may also be loaded onto a computer orother programmable data processing apparatus to cause a series ofoperational steps to be performed on the computer or other programmableapparatus to produce a computer implemented process such that theinstructions which execute on the computer or other programmableapparatus provide steps for implementing the functions/acts specified inthe flowchart and/or block diagram block or blocks.

FIG. 1 is a block diagram of an exemplary client computer 102 in whichthe present invention may be utilized. Client computer 102 includes aprocessor unit 104 that is coupled to a system bus 106. A video adapter108, which controls a display 110, is also coupled to system bus 106.System bus 106 is coupled via a bus bridge 112 to an Input/Output (I/O)bus 114. An I/O interface 116 is coupled to I/O bus 114. The I/Ointerface 116 affords communication with various I/O devices, includinga keyboard 118, a mouse 120, a Compact Disk-Read Only Memory (CD-ROM)drive 122, a floppy disk drive 124, and a flash drive memory 126. Theformat of the ports connected to I/O interface 116 may be any known tothose skilled in the art of computer architecture, including but notlimited to Universal Serial Bus (USB) ports.

Client computer 102 is able to communicate with a service providerserver 152 via a network 128 using a network interface 130, which iscoupled to system bus 106. Network 128 may be an external network suchas the Internet, or an internal network such as an Ethernet Network or aVirtual Private Network (VPN). Using network 128, client computer 102 isable to use the present invention to access service provider server 152.

A hard drive interface 132 is also coupled to system bus 106. Hard driveinterface 132 interfaces with a hard drive 134. In a preferredembodiment, hard drive 134 populates a system memory 136, which is alsocoupled to system bus 106. Data that populates system memory 136includes the client computer's 102 operating system (OS) 138 andsoftware programs 144.

OS 138 includes a shell 140 for providing transparent user access toresources such as software programs 144. Generally, shell 140 is aprogram that provides an interpreter and an interface between the userand the operating system. More specifically, shell 140 executes commandsthat are entered into a command line user interface or from a file.Thus, shell 140 (as it is called in UNIX®), also called a commandprocessor in Windows®, is generally the highest level of the operatingsystem software hierarchy and serves as a command interpreter. The shellprovides a system prompt, interprets commands entered by keyboard,mouse, or other user input media, and sends the interpreted command(s)to the appropriate lower levels of the operating system (e.g., a kernel142) for processing. While shell 140 generally is a text-based,line-oriented user interface, the present invention can also supportother user interface modes, such as graphical, voice, gestural, etc.

As depicted, OS 138 also includes kernel 142, which includes lowerlevels of functionality for OS 138, including essential servicesrequired by other parts of OS 138 and software programs 144, includingmemory management, process and task management, disk management, andmouse and keyboard management.

Software programs 144 may include a browser 146 and email client 148.Browser 146 includes program modules and instructions enabling a WorldWide Web (WWW) client (i.e., client computer 102) to send and receivenetwork messages to the Internet using HyperText Transfer Protocol(HTTP) messaging, thus enabling communication with service providerserver 152. Software programs 144 also include an event correlationmodule 150. The event correlation module 150 includes code forimplementing the processes described in FIGS. 2 through 4 describedhereinbelow. In one embodiment, client computer 102 is able to downloadthe event correlation module 150 from a service provider server 152.

The hardware elements depicted in client computer 102 are not intendedto be exhaustive, but rather are representative to highlight componentsused by the present invention. For instance, client computer 102 mayinclude alternate memory storage devices such as magnetic cassettes,Digital Versatile Disks (DVDs), Bernoulli cartridges, and the like.These and other variations are intended to be within the spirit andscope of the present invention.

FIG. 2 is a simplified block diagram of an event correlation module asimplemented in an embodiment of the invention. In this embodiment,network 128 comprises a network 202 implemented with the SynchronousOptical Networking (SONET) or Synchronous Digital Hierarchy (SDH)multiplexing protocols. Network 128 further comprises a networkmanagement system 220, sub-network ‘A’ 226 and sub-network ‘C’ 250. Thenetwork management system further comprises an event correlation module150, a repository of circuit path, device, and interface data 222, and arepository of event and alarm data 224. The SONET/SDH network 202further comprises SONET/SDH network devices ‘A’ 204, ‘B’ 206, ‘C’ 208,and ‘D’ interconnected by circuits 212, 214, 216, and 218. Thesub-network ‘A’ 226 further comprises network devices ‘A1’ 228, ‘A2’230, ‘A3’ 232, and ‘A4’ 234, interconnected by circuits 236, 238, 240,242, 244, and 246. The sub-network ‘C’ 250 further comprises networkdevices ‘C1’ 252, ‘C2’ 254, ‘C3’ 256, and ‘C4’ 258, interconnected bycircuits 260, 262, 264, 266, 268, and 270. As shown in FIG. 2,sub-network ‘A’ 226 is connected to the SONET/SDH network 202 viacircuit 248 between device ‘A1’ 228 and device ‘A’ 204. As likewiseshown in FIG. 2, sub-network ‘C’ 250 is connected to the SONET/SDHnetwork 202 via circuit 272 between device ‘C1’ 252 and device ‘C’ 208

Knowledgeable practitioners of the art are aware that a link failure ina SONET/SDH network 202 may cause multiple sympathetic network events oralarms to emanate from circuits that have upper layer time slots. Thesenetwork events or alarms can likewise result from the ingress and egressof each time slot of each circuit. As an example, a an Optical Carrier 3(OC3) failure occurring in circuit 213 can cause network managementalarms to emanate from each of the three Digital Signal 3 (DS3) timeslots on each side of the circuit 213. As a result, sympathetic networkevents and alarms emanate from affected devices and circuits along thepath. As an example, a network path originates at device ‘A3’, traversescircuit 240 to device ‘A4’ 234, and then traverses circuit 242 to device‘A1’ 228, and then continues on via circuit 248 to device ‘A’ 204. Onceon the SONET/SDH network 202, the network path traverses circuit 212 todevice ‘B’ 202, followed by traversing circuit 214 to device ‘C’ 208,where it traverses circuit 272 to device ‘C1’ 252. The network path thentraverses circuit 260 to device ‘C2’ 254, where it traverses circuit 262to terminate at device ‘C3’ 256. Should an OC3 failure occur at circuit213, it is apparent that network events and alarms will emanate from alldevices and circuits along the network path unless they are suppressedby the network management system 220. However, determining which of thenetwork events or alarms are the source cause, or “parent,” versussympathetic, or “child” can prove challenging.

In various embodiments, an event correlation module 150 is implementedto perform event correlations to determine which network events oralarms are parents and which ones are children. In these and otherembodiments, a SONET/SDH port of a network device 204, 206, 208, 210 ismonitored for the occurrence of a loss of signal (LOS) or a loss offrame (LOF) event. Likewise in these embodiments, the monitoring of theSONET/SDH port is at the physical layer interface, not a time slot. If aLOS/LOF network event is detected, then a repository 222 of circuitpath, network device, and device interface data is queried forinformation related to the LOS/LOF network event is queried. Next, therepository 222 is queried for information related to each network deviceat each hop of the circuit path associated with the LOS/LOF networkevent. To use the prior example, network devices in the circuit pathwould include network devices 232, 234, 228, 204, 206, 208, 252, 254,and 256. In various embodiments, a user of the event correlation module150 selects time intervals for other network events or alarms occurringbefore or after the target LOS/LOF network event. A repository 224 ofnetwork event and alarm data is then queried to retrieve all networkevents or alarms occurring during the selected time interval. In variousembodiments, the queries are performed by the event correlation module150 of the network management system 220.

Information related to the network events or alarms occurring during theselected time interval are then compared to interfaces related todevices (e.g., network devices 232, 234, 228, 204, 206, 208, 252, 254,and 256) that are likewise associated with the circuit path associatedwith the LOS/LOF network event. In one embodiment, if the network eventor alarm occurring within the selected time interval does not match theinterface, then it is associated as a child network event of the LOS/LOFnetwork event. In another embodiment, the foregoing process is likewisefollowed for network path query events. However, if the network event oralarm occurring within the selected time interval matches the interface,then it is associated as a parent network event of a network path queryevent.

FIG. 3 is a flow chart of the operation of an event correlation moduleas implemented in an embodiment of the invention for the correlation ofchild events in a network. In this embodiment, circuit-based eventcorrelation is begun in step 302, followed by the monitoring of aSynchronous Optical Networking (SONET)/Synchronous Digital Hierarchy(SDH) port of a network device for the occurrence of a loss of signal(LOS) or a loss of frame (LOF) event. Likewise in this embodiment, themonitoring of the SONET/SDH port is at the physical layer interface, nota time slot. A determination is then made in step 306 whether a LOS/LOFnetwork event is detected on the physical port of the network device. Ifnot, a determination is made in step 324 whether to continuecircuit-based event correlation. If so, then the process continues,proceeding with step 304. Otherwise, circuit-based event correlation isended in step 326.

However, if it is determined in step 306 that a LOS/LOF network event isdetected, then a repository (e.g., one or more datastores) of networkdata is queried in step 308 to retrieve circuit path, network device,and device interface information related to the LOS/LOF network event.Next, the repository of network data is queried in step 310 forinformation related to each network device at each hop of the circuitpath associated with the LOS/LOF network event. Those of skill in theart will realize that when a network device is managed using SimpleNetwork Management Protocol (SNMP), the lowest Internet Protocol (IP)address associated with the network device is returned from the networkdevice interface with the network event. Typically, the lowest IPaddress does not necessarily correspond to the IP address of theloopback interface, which how most network devices are identified to anetwork management system. Skilled practitioners of the art willlikewise realize that certain SONET/SDH network devices in a ring mayact as a gateway for other switches. Accordingly, knowing that aparticular network event is associated with a network device that islikewise associated with the circuit path is advantageous for eventcorrelation.

In step 312, a user selects time intervals for other network events oralarms occurring before or after the target LOS/LOF network event. Instep 314, a repository (e.g., one or more datastores) of network eventand alarm data is queried to retrieve all network events or alarmsoccurring during the selected time interval. In various embodiments, thequeries are performed by an event correlation module of a networkmanagement system. In step 416, information related to the networkevents or alarms occurring during the selected time interval arecompared to interfaces related to devices that are likewise associatedwith the circuit path associated with the LOS/LOF network event. Adetermination is then made in step 318 whether an individual networkevent or alarm matches the interfaces. If so, then the processcontinues, proceed with step 316. Otherwise, the network event or alarmoccurring within the selected time interval is associated as a childnetwork event of the LOS/LOF network event in step 320. The childnetwork event is then suppressed. Otherwise, the network event isdesignated as a parent network event. It will be apparent to skilledpractitioners of the art that if the child network events were notsuppressed, then an “event storm” could occur, making it difficult todetermine the originating parent network event. A determination is thenmade in step 322 whether network event or alarm comparisons arecompleted. If not, the process continues, proceeding with step 316.Otherwise, the process continues, proceeding with step 324.

FIG. 4 is a flow chart of the operation of an event correlation moduleas implemented in an embodiment of the invention for the correlation ofparent events in a network. In this embodiment, path-based eventcorrelation is begun in step 402, followed by the monitoring of ingress,egress, and intermediate hops of interest along a network path in step404. A determination is then made in step 406 whether a network pathquery event is detected. If not, a determination is made in step 424whether to continue path-based event correlation. If so, then theprocess continues, proceeding with step 404. Otherwise, circuit-basedevent correlation is ended in step 426. However, if it is determined instep 406 that a network path query event has been detected, then arepository (e.g., one or more datastores) of network data is queried instep 408 to retrieve circuit path, network device, and device interfaceinformation related to the network path query event. Next, therepository of network data is queried in step 410 for informationrelated to each network device at each hop of the circuit path todetermine the trap source of the network path query event.

In step 412, a user selects time intervals for other network events oralarms occurring before or after the target network path query event. Instep 414, a repository (e.g., one or more datastores) of network eventand alarm data is queried to retrieve all network events or alarmsoccurring during the selected time interval. In various embodiments, thequeries are performed by an event correlation module of a networkmanagement system. In step 416, information related to the networkevents or alarms occurring during the selected time interval arecompared to interfaces related to devices that are likewise associatedwith the circuit path associated with the network path event. Adetermination is then made in step 418 whether an individual networkevent or alarm matches the interfaces. If not, then the processcontinues, proceed with step 416. Otherwise, the network event or alarmoccurring within the selected time interval is associated as a parentnetwork event of the network path query event in step 420. Adetermination is then made in step 422 whether network event or alarmcomparisons are completed. If not, the process continues, proceedingwith step 416. Otherwise, the process continues, proceeding with step424.

The flowchart and block diagrams in the figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods and computer program products according to variousembodiments of the present invention. In this regard, each block in theflowchart or block diagrams may represent a module, segment, or portionof code, which comprises one or more executable instructions forimplementing the specified logical function(s). It should also be notedthat, in some alternative implementations, the functions noted in theblock may occur out of the order noted in the figures. For example, twoblocks shown in succession may, in fact, be executed substantiallyconcurrently, or the blocks may sometimes be executed in the reverseorder, depending upon the functionality involved. It will also be notedthat each block of the block diagrams and/or flowchart illustration, andcombinations of blocks in the block diagrams and/or flowchartillustration, can be implemented by special purpose hardware-basedsystems that perform the specified functions or acts, or combinations ofspecial purpose hardware and computer instructions.

The terminology used herein is for the purpose of describing particularembodiments only and is not intended to be limiting of the invention. Asused herein, the singular forms “a,” “an” and “the” are intended toinclude the plural forms as well, unless the context clearly indicatesotherwise. It will be further understood that the terms “comprises”and/or “comprising,” when used in this specification, specify thepresence of stated features, integers, steps, operations, elements,and/or components, but do not preclude the presence or addition of oneor more other features, integers, steps, operations, elements,components, and/or groups thereof.

The corresponding structures, materials, acts, and equivalents of allmeans or step plus function elements in the claims below are intended toinclude any structure, material, or act for performing the function incombination with other claimed elements as specifically claimed. Thedescription of the present invention has been presented for purposes ofillustration and description, but is not intended to be exhaustive orlimited to the invention in the form disclosed. Many modifications andvariations will be apparent to those of skill in the art withoutdeparting from the scope and spirit of the invention. The embodiment waschosen and described in order to best explain the principles of theinvention and the practical application, and to enable others of skillin the art to understand the invention for various embodiments withvarious modifications as are suited to the particular use contemplated.

Having thus described the invention of the present application in detailand by reference to preferred embodiments thereof, it will be apparentthat modifications and variations are possible without departing fromthe scope of the invention defined in the appended claims.

1. A computer-implemented method for event correlation, comprising:performing, via a processor, a lookup of network devices, the lookupbeing performed on network devices interfacing with network eventsassociated with a network circuit within a predetermined period of time;matching, via the processor, events based on predetermined criteria togenerate a set of matched events; making, via the processor, at leastone member of the set of matched events a child network event;processing, via the processor, the network events to identify a probableparent network event, wherein the probable parent network event is not amember of the set of matched events, wherein the parent network event isassociated with a network path; and the child network event isassociated with a network circuit.
 2. The method of claim 1, wherein theperforming a lookup and the matching events are performed by an eventcorrelation module of a network management system.
 3. The method ofclaim 1, wherein the network events occur in a network using theSynchronous Optical Networking (SONET) protocol or the SynchronousDigital Hierarchy protocol.
 4. The method of claim 1, whereininformation related to the network devices is stored in a repository ofpath, network device, and device interface data.
 5. The method of claim1, wherein the predetermined period of time is selectable by a user. 6.A system comprising: a processor; a data bus coupled to the processor;and a computer-usable medium embodying computer program code, thecomputer-usable medium being coupled to the data bus, the computerprogram code used for performing event correlation and comprisinginstructions executable by the processor and configured for: performinga lookup of network devices, the lookup being performed on networkdevices interfacing with network events associated with a networkcircuit within a predetermined period of time; and matching events basedon predetermined criteria to generate a set of matched events; making atleast one member of the set of matched events a child network event; andprocessing the network events to identify a probable parent networkevent, wherein the probable parent network event is not a member of theset of matched events, wherein the parent network event is associatedwith a network path; and the child network event is associated with anetwork circuit.
 7. The system of claim 6, wherein the performing alookup and the matching events are performed by an event correlationmodule of a network management system.
 8. The system of claim 6, whereinthe network events occur in a network using the Synchronous OpticalNetworking (SONET) protocol or the Synchronous Digital Hierarchyprotocol.
 9. The system of claim 6, wherein information related to thenetwork devices is stored in a repository of path, network device, anddevice interface data.
 10. The system of claim 6, wherein thepredetermined period of time is selectable by a user.
 11. Anon-transitory computer-usable medium embodying computer program code,the computer program code comprising computer executable instructionsconfigured for: performing a lookup of network devices, the lookup beingperformed on network devices interfacing which interface with networkevents associated with a network circuit within a predetermined periodof time; and matching events based on predetermined criteria to generatea set of matched events; making at least one members of the set ofmatched events a child network event; and processing the network eventsto identify a probable parent network event wherein the probable parentnetwork event is not a member of the set of matched events, wherein theparent network event is associated with a network path; and the childnetwork event is associated with a network circuit.
 12. Thenon-transitory computer usable medium of claim 11, wherein theperforming a lookup and the matching events are performed by an eventcorrelation module of a network management system.
 13. Thenon-transitory computer usable medium of claim 11, wherein the networkevents occur in a network using the Synchronous Optical Networking(SONET) protocol or the Synchronous Digital Hierarchy protocol.
 14. Thenon-transitory computer usable medium of claim 11, wherein informationrelated to the network devices is stored in a repository of path,network device, and device interface data.
 15. The non-transitorycomputer usable medium of claim 11, wherein the predetermined period oftime is selectable by a user.
 16. The non-transitory computer usablemedium of claim 11, wherein the computer executable instructions aredeployable to a client computer from a server at a remote location. 17.The non-transitory computer usable medium of claim 11, wherein thecomputer executable instructions are provided by a service provider to acustomer on an on-demand basis.